https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428239#M122533 <P>Hey guys,</P> <P>I'm trying to add the values that correspond to specific rows in a search, to then display on a dashboard (graph/pie graph).</P> <P>For example, I have a table that returns as below:</P> <P>Scenario count<BR /> "C2C Scenario 1" 1<BR /> "C2C Scenario 2" 2<BR /> "C2C Scenario 3" 3<BR /> "C2C Scenario 4N" 4<BR /> "C2C Scenario 4Y" 5<BR /> "C2C Scenario 5" 6<BR /> "C2C Scenario 6" 10</P> <P>The above is currently returned using the below<BR /> index=ivr_app ("C4C Scenario")| rex "C2C Scenario (?<REASON>\w+)" | eval Scenario = "C2C Scenario"." ".Reason | stats count by Scenario</REASON></P> <P>I want to have a sum of the <STRONG>count</STRONG> <BR /> "C2C Scenario 2" + "C2C Scenario 4Y" + "C2C Scenario 5" as "POSITIVE"<BR /> "C2C Scenario 1" + "C2C Scenario 3" + C2C Scenario 4N" + "C2C Scenario 6" as "NEGATIVE"</P> <P>So end outcome would be a table that is</P> <P>Scenario sum<BR /> POSITIVE 11<BR /> NEGATIVE 18</P> <P>The plan will then be to display the above in a pie graph.</P> <P>Any help would be greatly appreciated! Thanks again. Loving getting into this stuff but starting off a little slow.</P> Tue, 06 Aug 2019 05:05:52 GMT hamishcross 2019-08-06T05:05:52Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428239#M122533 <P>Hey guys,</P> <P>I'm trying to add the values that correspond to specific rows in a search, to then display on a dashboard (graph/pie graph).</P> <P>For example, I have a table that returns as below:</P> <P>Scenario count<BR /> "C2C Scenario 1" 1<BR /> "C2C Scenario 2" 2<BR /> "C2C Scenario 3" 3<BR /> "C2C Scenario 4N" 4<BR /> "C2C Scenario 4Y" 5<BR /> "C2C Scenario 5" 6<BR /> "C2C Scenario 6" 10</P> <P>The above is currently returned using the below<BR /> index=ivr_app ("C4C Scenario")| rex "C2C Scenario (?<REASON>\w+)" | eval Scenario = "C2C Scenario"." ".Reason | stats count by Scenario</REASON></P> <P>I want to have a sum of the <STRONG>count</STRONG> <BR /> "C2C Scenario 2" + "C2C Scenario 4Y" + "C2C Scenario 5" as "POSITIVE"<BR /> "C2C Scenario 1" + "C2C Scenario 3" + C2C Scenario 4N" + "C2C Scenario 6" as "NEGATIVE"</P> <P>So end outcome would be a table that is</P> <P>Scenario sum<BR /> POSITIVE 11<BR /> NEGATIVE 18</P> <P>The plan will then be to display the above in a pie graph.</P> <P>Any help would be greatly appreciated! Thanks again. Loving getting into this stuff but starting off a little slow.</P> Tue, 06 Aug 2019 05:05:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428239#M122533 hamishcross 2019-08-06T05:05:52Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428240#M122534 <P>@hamishcross,</P> <P>If you dont have any common field to join them, you may try</P> <PRE><CODE>index=ivr_app ("C4C Scenario")| rex "C2C Scenario (?\w+)" | eval Scenario = "C2C Scenario"." ".Reason | stats count by Scenario | stats sum(eval(if(Scenario=="C2C Scenario 2" OR Scenario=="C2C Scenario 4Y" OR Scenario=="C2C Scenario 5",count,null()))) as POSITIVE, sum(eval(if(Scenario=="C2C Scenario 1" OR Scenario=="C2C Scenario 3" OR Scenario=="C2C Scenario 4N" OR Scenario=="C2C Scenario 6",count,null()))) as NEGATIVE </CODE></PRE> Tue, 06 Aug 2019 12:38:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428240#M122534 renjith_nair 2019-08-06T12:38:45Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428241#M122535 <P>I'm pretty sure you're missing a stats ahead of the sum?</P> Wed, 07 Aug 2019 05:22:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428241#M122535 hamishcross 2019-08-07T05:22:16Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428242#M122536 <P>ofcourse <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> , updated</P> Wed, 07 Aug 2019 05:25:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-values-from-specific-rows-to-then-display-in-pie/m-p/428242#M122536 renjith_nair 2019-08-07T05:25:00Z